Gen researchers uncover ‘Phantom Deal’ M&A imposter scam

Threat researchers at Gen, the company behind Avast, have identified a sophisticated M&A-style imposter scam dubbed ‘Phantom Deal’. The campaign uses social engineering, spear phishing, and forged legal documents to trick employees into making large, urgent wire transfers under the guise of a confidential corporate acquisition.

The scam relies on the secrecy of Non-Disclosure Agreements (NDAs) to isolate targets and move communications to off-channel platforms like WhatsApp. In one instance, an attacker impersonated a Dublin-based executive to target an employee. Researchers found that the same template and document fingerprints have been used against at least four other targets across various industries.